Human Factors in Runway Incursion Incidents Patrick Hudson Centre for Safety Studies Leiden University The Netherlands

Structure The major factor in runway incursion - Human Error Case studies Superficial causes - How incidents happen Underlying causes - Why incidents happen Where to look, what to do Conclusion

The Human Factor Runway incursions are usually failures to understand Where the plane is Where the runway is Where a vehicle is Classically failures of Situation Awareness Failures involve three different organisations Airlines - Pilots ATC providers -Air traffic controllers (arrivals, departures and ground) Airports - Airside vehicle staff etc. The individual pilots/ATCOs are seen as the problem The real causes are at the organisational level

Why do Accidents Happen? Equipment Breaks Doesn’t work Not fit for purpose People Incompetence Distracted Careless Reckless Organisation Organisations allow (known) failure to propagate Accidents waiting to happen have been accepted

Latent Conditions = Underlying Causes Latent Conditions represent accidents waiting to happen Many problems are to be found. E.g.: Poor procedures (Incorrect, unknown, out of date) Bad design accepted Commercial pressures not well balanced Organisation incapable of supporting operation Maintenance poorly scheduled Latent conditions make errors more likely or the consequences worse Individuals are the recipients of somebody else’s problems

Reason’s Swiss cheese model of accident causation Some holes due to active failures Hazards Other holes due to latent conditions Losses Successive layers of defences, barriers, & safeguards

Classic solutions Technical solutions to ensure nothing goes wrong Better ground radars, especially for poor visibility Extra aircraft systems Cameras to prevent excursions GPS-based navigation aids More attention to those causing the problems More rigid procedures In the cockpit In the tower More training and supervision of ATCo’s More data collection More analysis of existing incidents

Enhanced pilots’ interface: Voice and Data Link communications 3 dedicated Radio and Audio management panels Permanent ATC Mail box “Attention getter” ATC full page : access from FMS page or with direct function key on KCCU keyboard

Design improvements on pilot’s interface

camera display for taxi aid Fin tip & belly camera display Linked to A/C size Obviously many A/C systems affected by A/C size In terms of « flight operations » ground handling is affected Distance from NLG to MLG approx 29.7m (33.5m on A340-600) Fin and belly cameras provided to assist pilot for taxiing Airport moving map provided on ND Currently installed on the A340-600

Improved SA on ND: Airport navigation for taxi A380 cockpit proposal To display the airport map and the aircraft’s position To insert the prescribed taxi track To display other traffic

Problems with this approach Analysis implies having a framework to understand what is happening Analysis and investigation lead to paralysis Paralysis by analysis Action can be delayed until effectiveness is proven The solutions are still aimed primarily at the ‘sharp end’ Understanding major incidents highlights where the real problems may be found Major incidents can help us understand the causes SQ 006 at CKS, Taipei DAL 39 at Schiphol, Amsterdam SAS at Linate, Milan

SQ 006 Departure 747-400 TPE -LAX 31 October 2000 at 22.55 local time Fresh crew (had flown previous sector the day before) 3 pilots, 17 cabin crew 159 passengers Imminent arrival Typhoon Xangsane next morning Captain requested 05L because of weather conditions 05L is Cat II, longer runway with lower minima Aircraft crashed into barriers and construction equipment while taking off from 05R 83 people died

What happened? Aircraft hit obstructions after V1 The PVD (Parallel Visual Display) had failed to lock on to 05L localiser The PFD (Primary Flight Display) and the ND (Navigation Display) were both showing information inconsistent with 05L Pilot Error?

Taipei Chiang Kai Shek Airport

Some extra information The weather was bad and there was no ground radar for ATC The requested taxi route was altered by ATC Original route was along 05R in opposite direction No hold was required on taxiway NP The runway sign 05R-N1 was set up for departures from the domestic terminal The pilot turned continuously from N1 onto 05R Pilots discussed the PVD failure and decided to ignore it once they had a firm sight of an active runway Pilot error?

So - how did it happen? The pilots saw the centre line lights onto 05R They followed those lights - the only lights they could see! The other taxiway lights were invisible at 90o to line of sight There were insufficient taxiway lights (ICAO standard) on N1 One light was defective, one was dim 116 m to the first light and only 4 lights in total to 05L The designation sign for 05R was parallel to NP There were no flashing lights (wig-wags) at NP Holding Position for 05R ATC gave take-off clearance to SQ 006 as they reached the 05R holding position on NP and did not require them to hold There were no stop-bar lights or wigwags on N1 There were no ICAO required barriers on 05R

2nd light First visible taxiway light on N1

Pilot Error or System Failure? The pilots failed to look at all their instruments (ND) and actively ignored inconsistent information (PVD) They taxied far too short a distance to have gone from NP to 05L Therefore pilot error - BUT The airport lighting and defences did not meet ICAO standards 05R was probably lit as if it were functional and the taxiway lights on N1 were totally inadequate to form a line (gestalt) They were given T/O clearance one runway too early The visual picture was therefore compelling - one last runway, therefore the right one A typical example of an accident waiting to happen?

An accident waiting to happen extra information On 23rd October a freighter nearly started to take off from 05R On 30th October another freight aircraft repeated that near miss, having known about the 23rd October incident - and having recognised it as such after having nearly started on 05R as well There was no system for effective incident reporting (e.g. CHIRP) CKS did not have a Safety Management System There is no evidence that the hazards of the work program were identified, assessed or actively managed There is no evidence of an audit program

Who should have prevented the accident? Everybody Pilots should have stopped and asked the way But they had to trust Boeing instrumentation - and mistrust CKS CKS - and mistrust Boeing instrumentation Airport should never have allowed such a situation to arise Having discovered problems, should have corrected them (accidents usually have ‘hidden’ precursors)

standard barriers erected The SQ 006 event scenario Holding positions not marked clearly Pilots decide to take off on the ‘only’ runway Airport decides to change Runway structure Taxiway lights And runway signage do not meet ICAO standards No ICAO standard barriers erected

DAL 39 A Delta 76 aborted take-off at Amsterdam Schiphol on discovering 747 being towed across the runway Reduced visibility conditions (Phase - B) The tower controller was in training, under the tower supervisor There was another trainee and of the 11 people in the tower five were changing out to rest The incident happened between the inbound and outbound morning peaks

Hangar 11 Fairway G-3 Route KLM B747 Route DAL39 Runway 06/24 R-83

DAL 39 continued The marshalling vehicle called in unexpectedly as Charlie-8 with a towed KLM 747 from a parking apron Radio communications were unclear and C-8 did not state exactly where he was C-8 was given clearance The stopbar light control box confused everyone in the tower (it was a new addition) The controller, thinking that the tow had crossed successfully, gave DAL 39 clearance The DAL pilots saw the 747 and stopped in time

DAL 39 Initial Analysis Tow failed to report exact position or destination Tow not announced in advance (as per procedures for phase B) Assistant ATCo believed tow from right to left (did not know that a tunnel was in use) Controllers completely unfamiliar with new control box Ground radar pictures set up to cover different arrival and departure runways meant tow not visible on one screen Controller was meshing the tow between both take-offs and landings The tow, given clearance 1m 40 sec earlier, started off once the stopbars went out

Why did all this happen - 1? Tow was in violation, but this appears to be routine No clear protocols for ground vehicles and no hazard analysis Different language for aircraft (English) and ground vehicles (Dutch) Poor quality of ground radio Clearances appeared to be unlimited once given Tower supervisor was also OTJ trainer in the middle of the rush hour Altered control box not introduced to ATC staff

Why did all this happen - 2? No briefings about alterations at Schiphol (It has been a building site for years) Too many trainees in the tower in rush hour under low visibility conditions Differences in definition of low visibility between aerodrome and ATC No management apparent of the change in use of the S-Apron No operational audits by LVNL or Schiphol, of practice as opposed to paper Schiphol designed requiring crossing and the use of multiple runways for noise abatement reasons

The DAL 39 event scenario Pilots see 747 Tunnel brought into use and abort take-off Tunnel brought into use without briefings Routine violation of tow procedures Airport structure Airport decides to change airport structure Tower combining training and operations during difficult periods Controller gives clearance without assurance of tow position

SK 686 D-IEVX Linate A SAS MD-87 collided with a Cessna 525A business jet while taking off from 36R Visibility at 08.10 (local) was 50 -100 m (Fog) All 114 occupants and 4 ground staff died The Cessna was on the wrong taxiway crossing 36R The pilots of the Cessna were confused They thought they were on a different taxiway (R5, to the North) The MD-87 did nothing wrong There was no ground radar

The details - the Cessna “Delta Victor Xray taxi north via Romeo 5 QNH …, call me back at the stop bar of the … main runway extension” “Roger via Romeo 5 and … [QNH], and call you back before reaching main runway” The Cessna started off from the GA Apron in dense fog, turned left and then was faced with a split They should have gone left (R5) but went right (R6) If they had used their compass they would have noticed The only taxiway lights visible at that point led to R6 The markings were worn and not ICAO compliant The pilot went through a STOP line, a stop bar and a final yellow line on the taxiway

ATC ATC was using non-standard terms Read-back confirmation did not check the details SK 686 and D-IEVX were on different frequencies The next aircraft on ground frequency was spoken to in Italian (as were many transmissions) D-IEVX reported “approaching the runway … Sierra 4” S4 is on R6 and the equivalent on R5 would have taken much more than 2 1/2 minutes The controller appears to have believed they were on R5 and gave permission to taxi after stop-bar to proceed and “call me back entering the main taxiway”

Problems with T/O Clearances Both Taipei and Amsterdam had long-standing clearances D-IEVX had an apparent clearance to continue taxi-ing A 747 at Anchorage was given immediate clearance with 6 minutes taxi time and one runway crossing Should clearances be valid for more than 15 seconds?

ICAO SARPs ICAO sets standards for runway signage Runway signs Stopbars and Holding Points Taxiway lighting Problems with ICAO compliance at all airfields Taipei - lights, barriers, stopbars Amsterdam - traffic lights instead of stopbars Linate - markings on taxiways, lighting If these had been complied with fully would there have been any problems?

Visibility and Taxiway lighting All these incidents occurred under poor visibility conditions Pilots were forced to look out at where they were going Taxiways were visually compelling and there was no visible alternative at CKS or Linate Are airfields sufficiently well marked to be unambiguous under conditions of poor visibility?

ATC Language Two incidents involve the use of more than one Language - not best practice Many incidents are associated with failures to use aviation English ATC usage is nearly, but not quite, accurate enough to prevent most incidents Calls and read-backs are prone to confirmation bias Would strict adherence to established protocols have prevented these incidents?

Considerations for runway safety Initial analyses show both pilots and controllers to have been at fault - situation awareness failures The problem was that the situation was the problem, expecting awareness is expecting too much Deeper investigation begins to show that all cases were accidents waiting to happen The individuals were victims of systemic failures In no case was there any effective safety management as expected in other high hazard industries Few (if any) extra technical solutions would have been necessary if what should have been done was done

Conclusion Runway incursions appear to be due to individual errors Those individual errors are caused by system weaknesses Most major incidents have minor precursors Technical improvements may reduce low potential incidents - but these incidents would have been easily prevented by doing what already should have been done Most problems can be avoided by application of safety management principles (c.f. ICAO Annexes 11 & 14) Risk assessment Audit programs Reporting systems Continuous improvement learning from errors